An Investigator Would Like to Take a Forensic "Image" of a Suspect's

Question

Examlex · Accepted Answer

The Answer is (should include points such as):
The primary goal in obtaining data from a HDD is to do so without altering even one bit of data. A Message Digest 5 (MD5)/Secure Hash Algorithm (SHA)takes a "fingerprint" of a hard disk drive (HDD)before and after forensic imaging. A forensic computer examiner would run such an algorithm to demonstrate that the forensic image recovered is all-inclusive of the original contents and that nothing was altered in the process.

An Investigator Would Like to Take a Forensic "Image" of a Suspect's

Definitions: